Data Privacy Regulation in Macau

Kegler Brown Global Business NewsAugust 25, 2014by Vinita Mehra

Processing of personal data in Macau, which is one of the
two Special Administrative Regions (SAR) of the People's Republic of China, is
subject to observation of the Personal Data Protection Act (Law 8/2005, August
22, 2005). The Act is inspired by Portugal's
legislation, and, as a result, has the closest approach to the EU Data
Protection Directive of 1995 than any other country in Asia. The Office for Personal Data Protection
(OPDP) is the regulatory authority in Macau responsible for supervising and
enforcing the Act, and has very extensive powers. Breaches of the Act are subject to civil
liability, administrative and criminal sanctions.

The Act requires some procedures to be followed before
collecting and processing data, such as obtaining the consent of the data
subject. Additionally, there are certain occasions where the data controller
has to notify the OPDP or even request prior authorization before processing
personal data.

Transfers of personal data to any destination outside the
Macau SAR is prohibited unless an adequate level of protection is guaranteed by
the legal system of the country where the data is transferred, and such
determination is left under the discretion of the OPDP. The processing of sensitive personal
information is also forbidden save a few exceptions.

In 2013, Macau's OPDP has received a total of 2,276 enquires
relating to personal data as opposed to 990 received in 2012. The Office registered a growth of 20 percent of
investigations in 2013 as compared with 2012, introducing 141 investigations,
due to the raising awareness of the population because of the increasing
publicity around the Data Protection Act.

The majority of the investigation cases were based on the
lack of authority of the data controllers to use the data collected from the
data subject, followed by the failure to observe the data treatment principle,
and inappropriate protection of the data subject's rights. It is important to
note that most of the investigations
were initiated by direct complaints (47.5 percent) and reports (31.7
percent).